eschutho commented on PR #43870:
URL: https://github.com/apache/superset/pull/43870#issuecomment-6136106669
On Hugh's behalf: ad5bb47d4b rewrites `contains_jinja` in
`partition_mapping.py` to clear CodeQL alert #3953 (`py/polynomial-redos`).
- **What changed:** the lazy `{{.*?}}|{%.*?%}|{#.*?#}` regex is replaced
with a linear `str.find` scan: the first opening delimiter of each kind, then a
closing delimiter after it. It gives the same answer on every input. A new test
checks it against the old pattern on every string of up to seven characters
over the delimiter characters, and another times a 200,000-delimiter run.
- **Why not a length cap:** `is_transform_active` runs this on *stored*
transforms, which have no length bound, so a cap would have let an over-long
stored transform containing Jinja skip the Jinja refusal. Without a bound, the
old pattern was genuinely slow: about 10 s on 40 KB of `{{`.
- **CodeQL:** the run on the new head passes, and #3953 is reported as fixed
on the PR merge ref, so no maintainer dismissal is needed.
Re-requested review from @aminghadersohi and @sadpandajoe.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
